A hospital uses an AI system to analyze patient records for research. To protect patient identities, the system should not store or transmit any personally identifiable information (PII) outside the secure network. Which responsible AI principle is most directly addressed by this requirement?
Privacy and Security is the correct principle because this AI system handles patient records that contain protected health information (PHI/PII). To meet this principle, the solution must enforce encryption at rest and in transit, strict role-based access controls, and audit logging to prevent unauthorized disclosure. It also entails resilience against attacks that could expose patient data, which is exactly the stated requirement.
Why this answer
The requirement to not store or transmit PII outside the secure network directly addresses the Privacy and Security principle. This principle ensures that individuals' data is protected from unauthorized access or exposure, which is critical in healthcare AI systems handling sensitive patient records. By restricting PII to the secure network, the system upholds data confidentiality and compliance with regulations like HIPAA.
Exam trap
The trap here is that candidates may confuse Privacy and Security with Reliability and Safety, thinking that preventing data leaks is about system stability rather than data protection, but the core focus is on safeguarding sensitive information from unauthorized access or disclosure.
Why the other options are wrong
The requirement focuses on protecting patient identities by not storing or transmitting PII, which directly addresses privacy and security, not fairness.
The requirement focuses on protecting patient identities by not storing or transmitting PII, which directly relates to privacy and security, not inclusiveness. Inclusiveness is about ensuring the system works for all user groups, not about data protection.
The requirement focuses on protecting patient identities by not storing or transmitting PII, which directly relates to privacy and security, not reliability and safety. Reliability and safety concern system accuracy and harm prevention, not data protection.
When would these options actually be correct?
Fairness would be correct if the question described an AI system that must avoid bias against certain patient groups, such as ensuring equal treatment recommendations across demographics.
A question asks: 'An AI system for healthcare must provide equal quality of service across different demographic groups. Which principle is most directly addressed?' In that scenario, inclusiveness would be correct.
A question asking which principle ensures an AI system for medical diagnosis consistently produces accurate results and avoids causing patient harm due to errors or failures.
Why candidates pick the wrong answer
Candidates may confuse privacy with fairness because both involve ethical handling of data, but fairness is about equitable outcomes, not data protection.
Candidates may confuse inclusiveness with privacy because both involve ethical considerations in AI, but inclusiveness is about fairness across groups, not data protection.
Candidates may confuse 'safety' with data security, or think that protecting patient data is part of ensuring system safety, but safety here refers to operational reliability, not data confidentiality.